https://community.splunk.com/t5/Getting-Data-In/syslog-ng-to-HEC-data-persistence/m-p/411730#M72887 <P>Take a look at the native splunk-hec() driver in recent versions of syslog-ng PE.<BR /> <A href="https://support.oneidentity.com/syslog-ng-premium-edition/7.0.13/technical-documents">https://support.oneidentity.com/syslog-ng-premium-edition/7.0.13/technical-documents</A></P> <P>Batching and load balancing are built in now.</P> Fri, 19 Apr 2019 18:50:40 GMT hendrick 2019-04-19T18:50:40Z https://community.splunk.com/t5/Getting-Data-In/syslog-ng-to-HEC-data-persistence/m-p/411729#M72886 <P>How would we ensure data persistence/queuing when using Ryan Faircloth's (or a similar script) method to batch the syslog messages using a script rather than the default one message per POST of syslog-ng's http() output ?</P> <P>Scenario is if there's an 1h network outage between syslog-ng and the HEC HWFs</P> <PRE><CODE><A href="https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/" target="test_blank">https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/</A> </CODE></PRE> Fri, 19 Apr 2019 11:38:13 GMT https://community.splunk.com/t5/Getting-Data-In/syslog-ng-to-HEC-data-persistence/m-p/411729#M72886 splunk_zen 2019-04-19T11:38:13Z https://community.splunk.com/t5/Getting-Data-In/syslog-ng-to-HEC-data-persistence/m-p/411730#M72887 <P>Take a look at the native splunk-hec() driver in recent versions of syslog-ng PE.<BR /> <A href="https://support.oneidentity.com/syslog-ng-premium-edition/7.0.13/technical-documents">https://support.oneidentity.com/syslog-ng-premium-edition/7.0.13/technical-documents</A></P> <P>Batching and load balancing are built in now.</P> Fri, 19 Apr 2019 18:50:40 GMT https://community.splunk.com/t5/Getting-Data-In/syslog-ng-to-HEC-data-persistence/m-p/411730#M72887 hendrick 2019-04-19T18:50:40Z